CVE-2019-11447

CVE-2019-11447 affects CuteNews 2.1.2 (CutePHP CuteNews). The vulnerability allows remote code execution via the avatar upload process: an attacker can place a crafted file in avatar_file for index.php?mod=main&opt=personal, exploiting insufficient validation of image size ($imgsize) in /core/mod...

CVE-2019-11447

An issue was discovered in CutePHP CuteNews 2.1.2. An attacker can infiltrate the server through the avatar upload process in the profile area via the avatarfile field to index.php?mod=main&opt=personal. There is no effective control of $imgsize in /core/modules/dashboard.php. The header content ...

CutePHP CuteNews 1.3.6 X-Forwarded-For Script Injection Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/12691/info A remote script injection vulnerability affects CutePHP CuteNews. This issue is due to a failure of the application to properly sanitize user-supplied input prior to using it to carry out critical functionality...

CutePHP CuteNews 1.4.1 Index.PHP Cross-Site Scripting Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/16961/info CuteNews is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before including it in dynamically generated HTML content. A...

CutePHP CuteNews 1.4.1 Editnews Module Cross-Site Scripting Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/17592/info CuteNews is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. An attacker may leverage this issue to have arbitrary scrip...

CutePHP CuteNews 1.3 HTML Injection Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/8060/info CutePHP is prone to HTML injection attacks. The vulnerability exists due to insufficient sanitization of user-supplied input. Specifically, user-supplied input to news posts are not sufficiently sanitized of...

Cutenews 1.5 Cross Site Scripting

Exploit Title: Cutenews 1.5 Cross site Scripting Vulnerability Google Dork: Intext:"Content Management Powered by CuteNews" Date: 09/04/2012 Author: Crim3R & Ajax Security Team Site : Http://AjaxTm.com/ Vendor Home OR download link: http://cutephp.com/click.php?cutenewslatest Tested on: all...

CuteNews - 'page' Local File Inclusion

========================================================== CuteNews page local File Inclusion Vulnerability ========================================================== vendor: http://cutephp.com/ Author: eidelweiss Contact: eidelweiss at windowslive dot com...

CuteNews 1.4.6 Insecure Cookie Handling

======================================================================================== | Title : CuteNews 1.4.6 Insecure Cookie Handling Vulnerability | Author : indoushka | email : [email protected] | Home : Souk Naamane - 04325 - Oum El Bouaghi - Algeria -00213771818860 | | Web Site :...

CVE-2009-4250

Multiple cross-site scripting XSS vulnerabilities in CutePHP CuteNews 1.4.6 and UTF-8 CuteNews before 8b allow remote attackers to inject arbitrary web script or HTML via 1 the result parameter to register.php; 2 the user parameter to search.php; the 3 catmsg, 4 sourcemsg, 5 postponedselected, 6...

CVE-2009-4249

Multiple cross-site scripting XSS vulnerabilities in CutePHP CuteNews 1.4.6, when registerglobals is enabled and magicquotesgpc is disabled, allow remote attackers to inject arbitrary web script or HTML via the 1 lastusername and 2 mod parameters to index.php; and 3 the title parameter to...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in CutePHP CuteNews 1.4.6 and UTF-8 CuteNews before 8b allow remote attackers to inject arbitrary web script or HTML via 1 the result parameter to register.php; 2 the user parameter to search.php; the 3 catmsg, 4 sourcemsg, 5 postponedselected, 6...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in CutePHP CuteNews 1.4.6, when registerglobals is enabled and magicquotesgpc is disabled, allow remote attackers to inject arbitrary web script or HTML via the 1 lastusername and 2 mod parameters to index.php; and 3 the title parameter to...

CVE-2009-4250

CVE-2009-4250 affects CuteNews/CuteNews UTF-8 workflows (CuteNews 1.4.6 and UTF-8 CuteNews before 8b). It describes multiple cross-site scripting (XSS) vulnerabilities allowing injection of arbitrary script/HTML via: register.php (result), search.php (user), editnews/index.php (cat_msg, source_ms...

CVE-2009-4249

CVE-2009-4249 affects CuteNews 1.4.6 (CutePHP): multiple XSS vulnerabilities when register_globals is on and magic_quotes_gpc is off. Attack surface includes index.php parameters lastusername and mod, and search.php parameter title, enabling remote script/HTML injection. OpenVAS notes multiple vu...

CVE-2009-4250

Multiple cross-site scripting XSS vulnerabilities in CutePHP CuteNews 1.4.6 and UTF-8 CuteNews before 8b allow remote attackers to inject arbitrary web script or HTML via 1 the result parameter to register.php; 2 the user parameter to search.php; the 3 catmsg, 4 sourcemsg, 5 postponedselected, 6...

CVE-2009-4249

Multiple cross-site scripting XSS vulnerabilities in CutePHP CuteNews 1.4.6, when registerglobals is enabled and magicquotesgpc is disabled, allow remote attackers to inject arbitrary web script or HTML via the 1 lastusername and 2 mod parameters to index.php; and 3 the title parameter to...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in CutePHP CuteNews 1.4.6 and UTF-8 CuteNews before 8b allows remote attackers to hijack the authentication of administrators for requests that create new users, including a new administrator, via an adduser action in the editusers module in index.php...

Cross site scripting

Cross-site scripting XSS vulnerability in index.php in CutePHP CuteNews 1.4.6 and UTF-8 CuteNews 8 and 8b, when magicquotesgpc is disabled, allows remote attackers to inject arbitrary web script or HTML via the body of a news article in an addnews action...

CVE-2009-4172

Cross-site scripting XSS vulnerability in index.php in CutePHP CuteNews 1.4.6 and UTF-8 CuteNews 8 and 8b, when magicquotesgpc is disabled, allows remote attackers to inject arbitrary web script or HTML via the body of a news article in an addnews action...